MIS PWS draft.pdf

RFQ 8250

1/30/2022

PERFORMANCE WORK STATEMENT (PWS)

MANAGEMENT INFORMATION SYSTEM (MIS) SUPPORT SERVICES

C.1 INTRODUCTION/ BACKGROUND

The Internal Revenue Service (IRS), Criminal Investigation’s (CI) is the law enforcement arm of the IRS. CI is charged with the enforcement of the federal income tax statutes. CI's top priority is the investigation of violations of the federal income tax law. Additionally, CI special agents lend their financial investigative expertise to money laundering and narcotics investigations conducted in conjunction with other law enforcement agencies at the local, state and federal levels.

CI is uniquely responsible within the IRS for enforcing criminal statutes of the Internal Revenue Code and other related financial crimes statutes such as money laundering and Bank Secrecy Act laws. CI enforces such criminal statues by supporting multiple types of investigations. These investigations require CI to control and maintain tax, grand jury, law enforcement sensitive but unclassified (SBU), and classified data.

The Internal Revenue Service (IRS) Criminal Investigation’s (CI) mission is to investigate potential criminal violations of the Internal Revenue Code and related financial crimes in a manner that fosters confidence in the tax system and compliance with the law. CI also participates with other law enforcement agencies in joint investigations that help lead to major convictions on high profile cases involving such issues as political corruption, corporate fraud, narcotics trafficking, and terrorist financing.

To continue the support without impacting the day-to-day operations of the organization’s mission, strategic goals, and objectives, CI has a need to obtain experienced master level contractors support for its information technology law enforcement Management Information Systems (MIS) which consists of the Criminal Investigation Management Information System (CIMIS) and the Asset Forfeiture Tracking and Retrieval (AFTRAK) System.

CIMIS is a management tool for tracking the status and progress of IRS CI investigations, time expended by employees, employee information, and investigative equipment. CIMIS is the primary management and supervisory support tool for IRS CI by providing accurate, real time information on CI operations to all levels of management throughout the CI organization.

CIMIS is the vehicle that collects, compiles, and delivers information on investigative activities and legal actions to authorized users within CI. Data contained in CIMIS is used to respond to congressional mandates, Treasury regulations, Office of Management and Budget (OMB) requirements, and IRS directives. This data is also shared with other CI applications as well as other external agencies. CIMIS is the official source of information used by IRS CI when preparing statistical information for congressional testimony and for releasing statistical information on prosecutions resulting from CI investigations to the media. CIMIS is the central tool used by CI management to achieve effective coordination of investigative activities, and to ensure CI’s progress toward IRS strategic enforcement goals. CIMIS was first released in 2005 with subsequent releases to increase system functionality and to implement infrastructure upgrades.

CIMIS is a web application accessible within the CI Intranet using Internet Explorer /MS Edge (11.0). The application uses Microsoft .Net technologies (version 4.7.1) and is deployed on a secure Microsoft Internet Information Server (IIS) version 8.5 web server that resides at the CI Memphis Computing Center (MCC) in Memphis, Tennessee. SQL Server 2012 Enterprise is the RDMS software utilized. CIMIS reports are developed using SAP Crystal Reports 2016 and managed by Business Objects Business Intelligence Version 4.2.

AFTRAK is used to manage and track status, inventory and disposition of assets seized and forfeited in the course of CI investigations. CI conducts asset seizure and forfeiture activity in conjunction with its criminal investigations and manages asset inventories and distribution of proceeds under the guidance of the Treasury Executive Office of Asset Forfeiture (TEOAF). Proceeds from the disposition (sale) of forfeited assets will fund operations of CI and other law enforcement agencies supporting CI’s investigations, as well as compensation for victims of criminal activity. AFTRAK was first released in 2010 with subsequent releases to increase system functionality and to implement infrastructure upgrades.

AFTRAK is a web application that is tightly integrated with CIMIS and shares the same framework with CIMIS to leverage CIMIS’ security, user roles, and other administrative functions. AFTRAK also shares the physical database with CIMIS and uses many of the entities developed for CIMIS that are common to both systems.

These two legacy applications contain large amounts of custom code. The current MIS user population is over 2600 active users. The system is leveraged 24/7. The typical daily workday (M – F) usage averages approximately 10 percent; between 240—260 distinct users will engage the MIS applications during the course of a weekday. During peak system usage (Time Reporting entry), the system will support daily usage approaching 40 percent (900 – 1000 users).

Approximately 17 new enhancement requests per year (business suggestions or security findings) have been submitted for the last 4 years. The Enhancement inventory between CIMIS and AFTRAK contains approximately 400 open items on file. The MIS deployment strategy is to target 6-8 deployments per year. Based upon changes in business objectives of the organization, legislative reporting requirements, and infrastructure and technology changes, the MIS regularly requires ongoing enhancements along with supporting the Operations and Maintenance (O&M) rapid deployment of business functionality and infrastructure updates to the production environment.

C.2 TASK ORDER OBJECTIVES

Firm-Fixed Price (FFP) enhancements once fully implemented into the production environment will be subsequently supported under the O&M Firm-Fixed Priced SUB-TASKs within this

PWS.

Management Information Systems (MIS) will be updated through rapid production deployment releases to reflect enhancements or improvements shall be available to the end user throughout the year. Due to the need for continuous availability of the system, contractor resources assigned are required to have approved High-Risk Background Investigations (BIs) and drug tests. All documents requesting the High-Risk Background Investigations shall be submitted prior to the Orientation Briefing. This will allow the contractor to come on board during the Base Period and immediately support the Transition to Support (T2S) effort by assisting the Government with the transition of the work from the current contractor.

The objectives of this task order are to support the MIS system operations and maintenance, system enhancements as needed to meet the business objectives, requirements and mandates, and to assist the CI Project Manager with Project Management and Enterprise Life Cycle (ELC) support.

C.3 SCOPE OF WORK

The scope of this task order requires Contractor support related to:

Operations and maintenance constitute the functions duties and labor associated with the daily IT operations and maintenance support of the MIS applications and systems to include installation, updates, and configuration of new or existing hardware, and software as required in the environment needed to preserve the applications so that they continue to provide acceptable services to the end user base.

Developer supports the operation and maintenance and enhancement activities for MIS Projects to include change requests:

• Support the creating, use and maintaining the web applications,

• Maintain and enhance the database for use by Criminal Investigation,

• Develop and enhance the user interface with these applications,

• Assist in developing and enhancing these web applications,

• Support the users with training and updates,

• Perform System Management support to maintain compliance of the systems, documentation and processes to FISMA Security requirements and resolving issues generated through continuous monitoring processes, official mandates and annual security testing. The IRS re-writes FISMA controls as IRMs to map FISMA security requirements to IRS systems and business requirements,

• Deploy application updates to the CI MIS databases for Production and User Acceptance Testing (UAT) Databases

• Implement data corrections for the business owners

• Generate monthly database snapshots

• Execute database scripts for CI Reorganization’s

• Secure and process new sanitized databases for Development/Test purposes

• Add/Remove Ad-Hoc query users

• Monitor overall state of the databases – various SQL jobs, status of SQL backups

• Coordinate and schedule server wide actions with IRS CI TOC personnel e.g., monthly security patches

• Maintain efficient, high performing interfaces between the MIS Projects and IRS required systems,

• Perform detailed design, enhancement, and detailed testing of every release components to include system generated reports, update necessary documentation according to IRS Enterprise Life Cycle (ELC) standards, and process owner required templates; and support rapid deployment efforts,

• Comply with IRS infrastructure, maintaining compliance with IRS standards and processes including the IRS Enterprise Life Cycle (ELC), Enterprise Architecture, Internal Revenue Manual (IRM), project requirements, as well as IRS Security and Privacy policies,

• Comply with current legislative changes, software vendor mandates and changing laws, regulations, policies, and procedures,

• Ensure timely delivery of releases defect analysis and action items,

• Ensure all requirements and traceability matrices are maintained in Rational Next

Generation DOORS (or equivalent tool, as defined by the government),

• Ensure all source code and related transmittals/install instructions are stored in Rational

Team Concert (or equivalent tool, as defined by the government),

• Ensure all defects are recorded and tracked through Rational Quality Manager (or equivalent tool, as defined by the government) and correctly apply the type/status code definitions for defects,

• Ensure all project documentation is maintained in the projects’ SharePoint Process Asset Libraries (PALs),

• Support Data and Database Management activities,

• Support User Acceptance Testing and production deployments

• Perform system performance testing on the MIS applications to ensure there is no impact to system response time,

• Perform Project Management activities and support,

• Support and manage Development Modernization and Enhancement activities

• Criminal Investigation will benefit from improvements such as new and updated reports, updates in user interface which will include investigation statistical reporting, investigation tracking, improved investigative research, improved communications, and enforcement focused on non-compliant taxpayers.

The contractor shall comply with the following standards and guidance:

• Internal Revenue Manual (IRM) 10.8.1 Information Technology (IT) Security

• IRM 2.16 IRS Enterprise Life Cycle (ELC)

• IRS Enterprise Architecture (EA)

• Requirements Engineering Program Office (REPO)

• Section 508 of the Rehabilitation Act

• National Institute of Standards and Technology (NIST)

• Federal Information Security Management Act (FISMA)

• IRM 2.5.3 – Systems Development, Programming and Source Code Standards

• IRM 2.5 Systems Development,

• IRM 2.127 Software Testing Standards and Procedures

• Configuration Management (Configuration Identification Index (CII) Assignment to documentation)

• CI’s Defect Tracking and Reporting

• CI’s Risks/Issues Tracking and Reporting

• CI’s Source Code Management

• CI’s Project Artifacts Document Management

C.3.1 SUB-TASK 1, ORIENTATION BRIEFING (FFP)

Standard

The Contractor shall conduct a kickoff/orientation briefing for the Government within ten (10) business days after award. The government does not require an elaborate orientation briefing, nor does it expect the contractor to expend significant resources in preparation for this briefing.

Rather, the intent of the briefing is to initiate the communication expectations and process between the government and contractor by introducing key Task Order participants, explaining their roles, reviewing communication ground rules and assuring a common understanding of Task Order requirements and objectives.

The orientation briefing shall be held at the Government's facility and both parties shall mutually agree upon the date and time.

The completion of this briefing shall result in the following:

• The contractor and Government personnel who will perform work under this task order will be introduced. The Government will show the facilities available to the contractor, who will be performing work at the Government's site.

• The Government may provide any Government Furnished Property (GFP) to the contractor at this time.

• Initial paperwork required for contractor personnel clearances will be submitted to the government before the Orientation Briefing.

• Any issues concerning the contractor clearances for contractor personnel will be discussed.

• The contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this PWS.

• The contractor shall provide the accounting period end dates to be used for the term of this task order.

DESIRED OUTCOME – The intent of the briefing is to initiate the communication process between the Government and Contractor by introducing key task order participants, background investigation paperwork explaining their roles, reviewing communication ground rules, and assuring a common understanding of the task order requirements and objectives.

The contractor Key Personnel [Program/Project Manager (PMP required certification); Senior Information Technology Specialist serving as System Administrator, Developer, Tester and SQL Database Administrator (DBA), must have valid active Secret or Top-Secret clearances at the date of award. Additionally, all key personnel must have had 10 years successful prior experience in maintaining sensitive data in a Law Enforcement capacity and/or maintaining a FISMA “Moderate Risk” system with sensitive data, including but not limited to PII, SBU and potential Grand Jury investigative information. The contractor’s Key Personnel shall present the materials. The Contractor shall develop a cooperative/partnership working relationships with Criminal Investigation stakeholders to ensure operations and performance is aligned with business goals and objectives.

C.3.2 SUB-TASK 2, RAMP-UP /TRANSITION-IN SUPPORT (FFP)

The first 3 months of the base period shall be utilized to accomplish all necessary transition-in related support. The period will consist of two distinct phases, a two-month Ramp-Up period and one month knowledge transfer period. The Contractor shall be fully prepared to perform all necessary support under this task order by the conclusion of the 3 months. The Contractor shall begin working in good faith with the incumbent immediately upon task order award to establish a formal Transition Agreement (TA) which will be based on the incumbent’s existing Transition Plan and shall include points of contact and responsibilities for both parties and milestone dates.

Throughout the Transition-in period and for as long after as requested by the Government, The Contractor shall submit a weekly staffing status report to the COR. The report shall list each position that will perform under the task order, the assigned subtask, and the current status (hired, not hired) as well as the clearance status (clearance package submitted, not submitted, interim clearance granted). For each position that remains unfilled, the status of recruitment and estimated hiring date shall be provided. The report shall contain, at a minimum:

• Hiring status (hired, not hired, expected hiring date)

• Clearance submission date or anticipated submission date and current status (cleared, not cleared, fingerprint date, and any notices)

Ramp-up During ramp-up, performance will be restricted to only the orientation briefing, and activities related to recruiting, achieving security clearances, onboarding for all Contractor personnel, and establishing a TA with the incumbent. No facility access or space will be provided. The Contractor shall ensure that all personnel clearance packages are submitted to the COR to initiate the clearance process according to the following deadlines.

The Contractor shall submit all personnel security clearance packages to the COR as follows:

• Within 5 business days of award for all Key Personnel and personnel that will participate during transition.

• Within 45 days of award for all other personnel

Transition-in The transition period will be devoted only to transition activities. During this time, the incumbent contractor will still be responsible for all day-to-day performance of work under this task order. The Contractor will work with the incumbent to execute transition activities. The

Contractor shall assign only personnel that are essential to the transition process to perform during the transition period. The Contractor shall coordinate and cooperate with the incumbent and the Government to ensure that all support is successfully transitioned. By the end of the Transition-in period, the Contractor shall ensure that all necessary knowledge transfer is completed. The Contractor shall begin performing all required support on the day following the Transition-in period.

DESIRED OUTCOME- The Contractor shall ensure that all necessary staffing is in place and clearances have been submitted timely. The Contractor shall ensure that all necessary knowledge transfer from the incumbent has occurred to enable them to execute all performance under this task order.

C.3.3 SUB-TASK 3, MANAGEMENT INFORMATION SYSTEMS (MIS)

OPERATIONS AND MAINTENANCE (FFP)

Operations and maintenance constitute the functions, duties and labor associated with the daily CI IT operations and maintenance support of the MIS applications and systems to include installation, updates, and configuration of new or existing hardware, and software as required in the environment needed to preserve the applications so that they continue to provide acceptable services to the end user base.

The contractor shall adhere to the IRS Enterprise Life Cycle methodology and deliver associated work products for each milestone that are clear, concise, and tailored to meet CI needs. The Project Manager will be a certified Project Management Professional (PMP) or have equivalent credentials (See Section C.3.8). To support the MIS applications (regarding hardware, software, and systems), the contract shall have experience in the following tools listed in Section C.3.8.

O&M makes up 85% of the total work under this PWS and is Firm Fixed Price (FFP). For the purposes of this PWS, Operations and Maintenance have been defined to include the following activities/support/services:

Operations and maintenance consist of the following:

• Integration and deployment of system modifications due to changes in legislative and IRS policy and software versions

• Design and Development

• Production Support – Transmittal development, deployment and supporting functional testing

• Defect Resolution – Customer / Tester service requests reported as defect via CI reporting and tracking tools

• Security Plan of Action and Milestone (POAM) fixes

• Testing

• Infrastructure upgrades / changes – when current applications, tools, and hardware have reached end of cycle whether it is vendor support, hardware lifecycle, Agency best practices (MS Technologies, Hardware / Software upgrade / refreshment version / release upgrades to existing products)

• Deploy application updates to the CI MIS databases for Production and User Acceptance Testing (UAT) Databases

• Implement data corrections for the business owners

• Generate monthly database snapshots

• Execute database scripts for CI Reorganization’s

• Secure and process new sanitized databases for Development/Test purposes

• Add/Remove Ad-Hoc query users

• Monitor overall state of the databases – various SQL jobs, status of SQL backups

• Coordinate and schedule server wide actions with IRS CI TOC personnel e.g., monthly security patches

• Knowledge Transfer – training, real life examples, or development experience for internal resources as stated in PWS

• Project Management – partnership with all leaders with the CI project office in support of successful releases

• Configuration Management

• Capacity performance as needed

• Requirements Management

The Contractor shall support the O&M team by providing program management, engineering, site, production, operations, requirements, analysis, design development, design code, test, and deployment support for MIS project. The Contractor shall comply with the CI change request process. A change request will be the vehicle for communicating any request for change to the requirements baseline originating from a stakeholder organization. The Change Request (CR) will describe, in detail, the change and rationale for the change.

The Contractor shall prepare an Impact Assessment for each change request that addresses the following areas: Cost, Documentation, Hardware/Software (incidental/system), Performance, Availability, Software Development Schedule, Subsystems and Training, the upgrading of infrastructure and applications components (HW/SW) as they reach end of life. The objectives are to ensure comprehensive coordination of the review of all change requests for in-depth analysis and complete impact assessment, provide IRS Configuration Control Board (CCB) members with complete and accurate data for appropriate change management and disposition and foster practical planning and implementation of approved changes.

The impact assessment will include the following:

• Description of work required

• List of impacted documentation (if any)

• Hardware / Software impact / changes

• Performance / Availability

• Subsystem impacted

• Training implications

• Schedule Information:

• Date of Approval is required to achieve desired implementation

• Duration and hours for requirements / analysis

• Duration and hours for development / coding

• Duration and hours for testing

• Cost Information:

• Total number of hours by labor category

• Total cost by labor category

• Total full-time employees by labor category

• Issues / Risks

In some instances, some CRs will be identified as a high priority and will require a Very Rough Order Magnitude (VROM) estimate to be completed within 5 business days. This VROM may be used to provide preliminary approval. Upon authorization from the PM and COR, the Contractor shall start work with “not to exceed” restrictions while completing the full impact assessment.

The following tasks reflect normal Operations and Maintenance activity during a calendar year:

Contractor shall provide O&M support for all MIS Projects listed in this PWS available to user community.

• Contractor shall perform requirement changes

• Baseline requirements for next release

• Develop enhancements/new requirements

• Contractor shall perform defect resolution

• Deliver updates for the MIS Projects for independent User Acceptance Testing (UAT)

• Support user acceptance testing of new release

• Support capacity performance testing of Loads processing

DESIRED OUTCOME – The development of a comprehensive solution for MIS shall include but not limited to developing and maintaining current functionality for each of the applications, updating and implementing new IRS/Legislative changes. All tasks identified in O&M support are completed throughout the lifecycle of the project to include project close-out. The contractor shall provide continuous, high availability services as established by operating agreements.

Supply technical expertise to identify, document and implement disciplined, repeatable procedures to operate, sustain, and manage the application in support of the overall CI organization. Complete ELC milestones and associated Milestone Readiness Reviews (MRRs) with no interruption of on-going CI operations or degradation of existing system performance.

C.3.3.1 Requirements Management

The Contractor shall provide support to the project PM in developing the set of requirements that define the scope of each release. The Contractor shall be responsible for clarifying its understanding of the scope, assessing the impact of the requested changes, and estimating the size of the effort.

The Contractor’s estimates must cover at a minimum the following areas:

• Analysis

• Application Requirements

• Design

• Development

• Documentation

• Integration, Test and Evaluation

• Deployment

The Contractor shall participate in the MIS Change Control Board (CCB) providing technical support to formalize acceptance of the project scope for each release. Scope verification requires reviewing deliverables and work items to ensure that they were completed correctly and satisfactorily. Once the scope is verified and approved, the Contractor shall develop a detailed schedule for their portions of the release, which will be integrated with the overall master MIS Applications Project schedule.

The schedule must include the categories defined above for estimation with the addition of Project Management:

• Planning

• Tracking

• Coordination

The Contractor shall provide project management support in accordance with the ELC and update the IRS ELC artifacts documentation and sub-plans (RTM, RTVM, etc.) based upon the most recent guidance and templates found on the ELC Project Management Office website.

DESIRED OUTCOME - The development a set of requirements that meets the scope; using a consistent and repeatable process as defined by the Requirements Engineering Program Office

(REPO).

C.3.3.2 System Testing and Evaluation

Support the deployment of the application into the government test and production environment with updated transmittals and build documentation. Support the design, development, and test environments. Support of CI approved Requirements, Test, Source Code Management Software tools and MIS Project Process Asset Library. Support IRS CMMI Level 3 or higher industry standards and make recommendations. A government approved CMP and a complete inventory of approved changes.

The Contractor shall implement a test plan that conforms to the IRS test procedures. The primary objective of the system test is to validate that the changes to the application software and database meet the specified requirements of the customer and shall perform satisfactorily in the production environment. Test activities will be coordinated with representatives from CI. The test plans, RTM, RTVM, test cases, defect tracking artifacts are considered government documentation and shall be available to the government for review and approval. The IRM 2.5 Systems Development and IRM 2.127 Software Testing Standards and Procedures shall be used as the basis for Contractor testing.

The following tests shall be conducted:

All Testing as stated in IRM 2.5 and IRM 2.127, Performance Testing,

• 508 Testing

DESIRED OUTCOME – The contractor shall ensure that all software meets the in-scope requirements and performs in the test and production environment. The contactor shall provide copies of the ELC artifacts (System Test Plan, RTM, RTVM and End of Test Completion Report) acceptable to the Government.

C.3.3.3 Configuration Management

The Contractor shall develop a Configuration Management Plan (CMP) that meets all IRS CMMI Level 3 or higher industry standards and IRS Configuration Management Process in accordance with IRM 2.150. The CMP is baselined as a subsidiary of the Supplier Project Management Plan. The CMP shall document and control technical and administrative change requests, including hardware, software, and design changes.

The Contractor shall:

• Provide evaluation results to the CI Configuration Control Board (CCB) within the timeframe established by the projects CCB Guidelines. The CI CCB will govern procedures to handle changes, approval, and categories of changes. The changes must be documented and captured so that the evolution of the baseline can be documented.

• Support and work with the CI PM and CI Technical Lead in the development of all releases into government test and production environments and update all existing CI Build Information Documentation as needed to allow for the successful deployment of the MIS project. The CI Technical Lead will use the CI Build Information Documentation when deploying into the government environments. They must also maintain all CI Build Documentation using the CI-approved source code management tool.

• Support and work with CI PM and CI Technical Lead in the creation of the contractor development and test environments. In addition, support CI Technical Lead in the administration of the CI approved Requirements, Test, Source Code Management Software tools and the CI MIS Project Process Asset Library.

DESIRED OUTCOME – The contractor shall assist with the deployment of the application into the government test and production environment with updated transmittals and build documentation. Support the design, development, and test environments. Support of CI approved Requirements, Test, Source Code Management Software tools and MIS Project Process Asset Library. Support IRS CMMI Level 3 industry standards and make recommendations. A government approved CMP and a complete inventory of approved changes.

C.3.3.4 Security

The Contractor shall support the CI Security Subject Matter Expert (SME) to ensure that the MIS projects O&M releases comply with IRS security requirements and processes (according to IRM

10.8 Security, Privacy and Assurance, Information Technology (IT) Security).

This includes:

• Support of the MIS Project CI PM and CI Technical Lead with meeting Security Control and Assessment (SCA) for MIS project releases while assisting the MIS project CI PM and CI Technical Lead and the security point of contact with security documentation, FISMA application material weakness reconciliation and processes associated with the IRS Security Controls Assessment (SCA).

• Create/update the required security artifacts based on the scope of the releases while assisting the CI PM and CI Technical Lead in Security Control Assessments, Enterprise Continuous Monitoring (ECM), and annual Security Table Top Exercises (TTE).

• Assist the MIS projects security point of contact with security documentation, FISMA application material weakness reconciliation and processes associated with the IRS SCA.

• Participate in Continuous Security Monitoring meetings, serve as the SME in the annual FISMA Table Top Exercises (TTE), participate in annual FISMA Security Controls testing and address the Security Controls Assessment findings.

The following deliverables are as required:

Conduct and review and address monthly IRS internal Security scans (ex. Guardium, Tripwire, AppScan, WPC, within 30 calendar days

• Review and address System Administrator’s Guide (SAG) for security issues

• Assist in Security Controls Assessment (SCA)

• Review and address Change Requests for security impacts

• Security Controls Assessment (SCA)

• Review and update of SCA documentation

• Review and update the System Security Plan (SSP)

• Review and update the Information System Contingency Plan (ISCP)

• Prepare a Security Risk Assessment (SRA)

• Prepare the Privacy and Civil Liberties Impact Assessment (PCLIA)

• Prepare the Security Impact Analysis (SIA)

• Prepare the Authorization Boundary Memo (ABM)

• Review and update the Design Documentation (i.e., Design Specification Report (DSR 1 and 2), System Design Document (based on milestone artifact requirement)

• Configuration Management Plan (CMP).

DESIRED OUTCOME – The Contractor shall be responsible for addressing all security incidents, developing a Plan of Action & Milestones (POA&M), and providing a solution to address the findings that resulted in a POAM that shall include a labor of effort budget for the solution. The contractor shall adhere and utilize all third-party security tools deemed necessary by Cybersecurity to ensure all application scan and vulnerabilities are addressed and remediated timely. The contractor shall provide support integration of monthly security patches. The contractor shall follow IRS security policy and standards sharing during MIS patch integration.

If needed, the contractor shall provide support after-hours (early morning, evening, weekends) patching as required to minimize service interruptions. The contractor shall apply patches to all IRS MIS environments based on best practices.

The Contractor shall be responsible for addressing all security incidents or Plan of Action & Milestones (POA&M) to include a budget of the labor of effort.

The Contractor shall provide support to the project CI PM and CI Technical Lead in addressing security findings. Support the annual FISMA security assessments and update / provide security artifacts to address audit findings. Prepare POA&M and budgetary LOE to address future solutions to audit findings.

C.3.3.5 Problem Resolution

The Contractor shall update code, ELC Deliverables as needed, as well as test, and support any changes required as a result of defective code, database errors or other errors that occur during the O&M phase, starting with the completion of the base period through the end of the contract.

The changes shall be transmitted to the Government within the prescribed period of problem resolution.

During production, the Contractor shall respond to all defects as specified below:

High – The application can be used, but with critical restrictions. Defect/discrepancy is critical.

The system does not function as expected; requirement is not met. Workaround does not exist.

Medium – The application can be used, but with minor restrictions. Defect/discrepancy is not critical. The system does not function as expected; requirement is not met. Workaround may exist.

Low – The application can be used, with no restrictions. Defect/discrepancy is cosmetic.

Cosmetic changes include spelling errors, window sizing, display, and layout.

Priority 1 - (High) - 1 business day Priority 2 - (Medium) – 3 business days Priority 3 - (Low) – 5 business days

The Contractor shall respond to all trouble tickets using CI’s approved defect tracking tool and submit a detailed analysis with suggested resolutions to the MIS PM, Technical Lead, and the CI CCB that confirms the scope, assessment of the impact, and estimates the size of the effort to fix a confirmed defect.

This detailed analysis will be used by the MIS PM, Technical Lead, and the CI CCB to allocate the fix to an interim release (patch) and scheduled release.

DESIRED OUTCOME – The contractor shall provide on time delivery of high-quality transmittals to the MIS Technical Lead that correct the problem(s) and submit bi-weekly problem resolution status reports as identified in the approved project schedule.

C.3.3.6 Performance Validation Measures

The Contractor shall monitor system behavior and timings when the applications are under stress due to a simulated monthly Diary Upload and optimize the system to ensure performance availability. The system performance shall be measure and reported in accordance with the approved project schedule.

DESIRED OUTCOME – The contractor shall ensure that the MIS system shall have no decline in the quality of system performance or availability. The measures gathered in LoadRunner (equivalent tool, as defined by the government) will include information such as the (Total Success Rate, Average Number of Users Running, and Average Time to Complete) and comparisons to historical performance results. The Performance Validation Measures shall be delivered to the CI Project team as defined in the MIS Projects schedule.

C.3.3.7 Enterprise Lifecycle (ELC) Documentation

The Contractor shall leverage “best practices” from Project Management Body of Knowledge (PMBOK) and shall use a standardized, project management methodology for managing the MIS ELC documentation. The goals of this methodology are to promote project consistency across the agency; help decision-makers make determinations regarding project status and success;

ensure that all documents and requirements are completed on time and within budget; identify risks and plan appropriate risk responses; and coordinate Transition Management activities.

Specifically, the Contractor shall provide ELC support and services as assigned:

Reviewing, developing/modifying, and maintaining the ELC deliverables, using ELC-approved templates (IRM 2.16) found on the IRS ELC website.

ELC documentation shall include:

• Project Tailoring Plan

• Project Management Plan and associated sub-management plans

• Transition Management Plan

• Contingency Management Plan

• Configuration Management Plan

• Project Charter

• Supplier Project Management Plan

• System Administrator’s Guide

• Requirements Management Plan and sub plans identified on the ELC website

• Risk Management Plan

• Design Specification Reports (DSR) (Part 1 and 2)

• System Deployment Plan

• System Test Plans

• End of Test Completion Reports

• Interface Control Documents

• User Documentation and Training Materials

• Requirements Traceability Verification Matrix (RTVM)

• Quality Management Plan\Risk Management Plan

• 508 documentation

• System Design Description (SDD)

• Provide support as needed for the following ELC milestone activities:

• Lessons Learned

• Transition Management

• Work Requests (WR)

• Configuration Management Plan

• Risk Management

• Requirements Management

• Security and Accessibility

• Lifecycle Stage Review

• Milestone Readiness Review

• Milestone Exit Review

• User Acceptance Testing

The Contractor shall contribute to and create and/or maintain development and system analysis/monitoring-related documents as specified by governing bodies such as CI Governance Board (CIGB), IT-Enterprise Services, IT-Enterprise Operations, and IT Cyber Security.

These analysis-related documents may include, and may not be limited to:

• Transmittal documentation to support software drops

• Mapping documents for interfaces to external systems

• Change Requests (CR) Impacts

• Capacity Performance Test Reports

DESIRED OUTCOME – Through its quality management approach, the Contractor shall deliver project ELC deliverables that are error free and on time to ensure the MIS project exits

ELC milestones and successfully deploys on schedule.

C.3.4 SUB-TASK 4, PROJECT MANAGEMENT PLANNING AND REPORTING (FFP)

The Contractor’s Project Manager shall provide project management support for the MIS Project. The project shall be managed in accordance with the appropriate ELC phase as described in IRM 2.16 and the industry standards of project management as defined in the Project Management Body of Knowledge (PMBOK).

Project management support shall consist of the following tasks:

Identify a Program Manager, as key personnel, with the responsibility for the overall coordination and management of the work required as well as the quality of all products and services delivered within the task order. This individual shall act as the primary point of contact with the government on contract performance issues and ensures project activities are compliant with Treasury standards, procedures, and security requirements.

Program management support in planning, organizing, directing, and controlling service provider resources in support of this Performance Work Statement (PWS) to successfully satisfy all requirements, terms and conditions specified in the task order. The Project Manager shall develop and implement the appropriate processes for project management deliverables that initiate, plan, execute, monitor/report and close project activities that successfully meet the PWS objectives.

Conduct a kickoff/orientation briefing for the Government within five (5) business days after award.

Program Management support shall be provided at the primary site. The contractor shall identify an appropriately skilled and knowledgeable Program Manager to fill a Key Personnel position.

The Contractor shall:

• Manage and coordinate all Contract tasks, working closely with and reporting to the government Project Manager

• Submit all required reports accurately and according to best government/industry best practices

• Present briefings on the status of the project and on the contract

• Participate in meetings with CI for the purpose of discussing risks and issues concerning the project.

• Accurately identify and escalate project risks.

• Provide Issue Tracking Reports

• Create and prepare an approved mitigation plan within ten (10) business days of risk/issue identification.

The Contractor shall create and maintain required technical documentation or provide technical input to required Enterprise Lifecycle (ELC) documentation for an ELC Managed Services project, to include:

• Business System Report

• Simplified Design Specification Report

• Design Specification Report

• Tailoring Plan

• Risk Management Plan

• Configuration Management Plan

• Integrated Master Schedule

• Configuration Worksheet

• Configuration and Data Items

• System Deployment Plan

• Lessons Learned

• Customer Technical Reviews

• Lifecycle Stage Reviews

• System Test Plans

• Interface Control Documents

• User Documentation and Training Materials

• Requirements documentation

• User Acceptability Testing (UAT)

Project Management

The Contractor shall:

• Provide analysis, SME advice, and assessment relating to application activities and initiatives.

• Prepare IRS Enterprise Life Cycle (ELC) required artifacts.

• Provide experienced staff and system subject matter experts.

• Perform requirements scoping with user groups

• Provide technical assistance.

• Create Requirements, as determined by users and approved by the Government Project

Manager

• Conduct regularly scheduled meetings, prepare status reports, and document meeting minutes and meeting notes.

• Prepare and manage a Work Breakdown Structure and Schedule using Microsoft Project.

• Work closely with system users to identify requirements and create workflows.

• Work with the technical staff to identify solutions to enhance system enhancements and system software upgrades.

• Develop and submit a weekly status report at the direction of the CI PM and COR. This report shall include, but is not limited to, information as to the status of all deliverables, the work performed in the prior two (2) week time period, data management and integration, issues and risks, change requests, work scheduled to be performed, and anticipated changes in contractor’s staffing.

• Participate in regularly scheduled status and event driven meetings with the MIS project

PM/Technical Lead and the business partners to review project change requests, issues/concerns, and planned activities for future deployment tasks. Additionally, time in this meeting will be allocated to discuss specific technical details relating to the application requirements, change proposals and the overall health of the project from a technical standpoint.

deliver project deliverables that are error free and on time to ensure the MIS project exits ELC milestones and successfully deploys on schedule.

• Develop and update project management initiatives, user requirements, and recommendations for execution

• Research and analyze user needs, initiatives, and change requests and assess impacts.

• Develop recommended metrics and strategies for implementing requirements and workflows.

• Develop Milestone planning recommendations and analysis.

• Contribute to Integrated Process Teams (IPT).

• Facilitate Teaming

• Develop recommended feedback mechanisms and assessment of feedback results.

• Provide planning, preparation, and input for meetings, working groups and teams.

C.3.4.1 Period of Performance Summary Work

Provide a summary of work performed and accepted by the Government, to include a list of deliverables and their acceptance date at the end of Base Period and each Optional Period of Performance.

The Government also reserves the right to request this report at any point during the performance of the order at the discretion of the Contracting Officer. This ad hoc report if desired will only be requested once during the life of the task order and is in addition to the regularly scheduled Period of Performance Summary report.

DESIRED OUTCOME – The contractor shall provide an accurate, up to date description of work performed, list deliverables and the date according to the approved project schedule.

C.3.4.2 Status Report and Meeting

The Contractor shall develop and submit a weekly, bi-weekly, and monthly status report at the direction of BSD PM and COR. This report shall include, but is not limited to, information regarding the status of all deliverables, identifying work performed in the prior two (2) week time period, identifying a work schedule to be performed and anticipated changes in contractor’s staff.

The Contractor shall participate in these regularly scheduled status and event driven meetings with the project PM and partners to review the project status report, project accomplishments, issues/concerns/risk, mitigation activities, and technical issues and concerns discovered during the week.

The Contractor shall take notes/minutes of these meetings and deliver within two (2) business days of the meeting to the BSD PM, and store meeting documentation within the SharePoint central repository for the MIS project.

DESIRED OUTCOME – The contractor shall submit accurate and timely of weekly or bi-weekly status report following deliverables and expected timeframes associated with the project and Contract Management task area.

The Government will use the detailed analysis of these status reports to allocate the fix to an interim release (patch) and scheduled release.

C.3.5 SUB-TASK 5, DOCUMENTATION

The Contractor shall be responsible for updating all the required ELC artifacts using the most current ELC and process owner templates as required per the ELC path selected for the release, all security documentation, and other project related documentation according to the established schedule. All project documentation (O&M, DME, Project Planning or Reporting) shall be created and updated using the ELC guidance. These documents need Government approvals and need to be filed in the MS SharePoint CI PAL which serves as the official project repository. A complete inventory of all project documentation and their associated location shall be provided to the Government at the completion of each release.

The documents shall be delivered in a format and software version of the Government’s choosing to include standard Microsoft Office/Commercial Off The Shelf (COTS) products to include, but not limited to:

• Microsoft Office Word

• Microsoft Office Excel

• Microsoft Office PowerPoint

• Microsoft Office Visio

• Adobe Acrobat

DESIRED OUTCOME – The contractor shall provide on time delivery of project documentation that meets ELC requirements and project schedule. All documentation shall be accurate, complete, understandable, and up to date.

C.3.5.1 ELC Documentation - FFP

The Contractor shall create, maintain, and complete every section of the Enterprise Life Cycle documents artifact as specified by the ELC guidance using the process owner templates and tailoring plan. Changes to the ELC governance structure, for example implementation of Capability Maturity Model Integration, (CMMI) may result in the Contractor being required to update content to conform to changes in document templates.

The CIMIS, AFTRAK applications also combine certain ELC documentation may include, and are not limited to be:

• 508 documentation

• Audit Plan

• Simplified Design Specification Report (SDSR)

• Supplier Project Management Plan

• System Administrator’s Guide

• Requirements Management Plan

• Requirements Traceability Verification Matrix (RTVM)

• Risk Management Plan

• Design Specification Reports (DSR) (Part 1 and 2)

• System Deployment Plan

• System Test Plans

• End of Test Completion Reports

• Interface Control Documents

• User Documentation and Training Materials

The contractor shall contribute to and create and/or maintain development and system analysis/monitoring-related documents as specified by governing bodies such as Executive Steering Committees (ESCs), IT-Application Development Program Management Office (AD PMO), IT-Enterprise Services, IT-Enterprise Operations and Cyber Security.

These analysis-related documents may include, and may not be limited to:

• Transmittal documentation to support software drops

• Mapping documents for interfaces to external systems

• Change Requests (CR) Impacts

• Capacity Performance Test Reports

• Input Requirements Assessment Database (IRAD)

DESIRED OUTCOME – The contractor shall deliver on time delivery of project documentation that meets ELC requirements, process owner templates and project schedule. All documentation is accurate, complete, understandable, and up to date.

C.3.6 SUB-TASK 6, DEVELOPMENT, MODERNIZATION AND ENHANCEMENT

(LH)

Development, Modernization and Enhancement (DME) is Labor Hours and not guaranteed to be funded every year. When requested, the Contractor shall provide DME work. The Government may also choose to accomplish DME project via FFP work requests. FFP requests will be negotiated with the Contractor and initiated via formal modification. The total value of the FFP modification will then be subtracted from the LH total for that period.

For the purposes of this PWS, DME work is defined to include the following activities, support, and services, on an as needed basis:

• Support System enhancements to new functionality

• Create, document, and update Application enhancements as approved by the business customer

• Create, document, and update major enhancements to the environment in support of IRS or security mandates

• Implement major enhancements to the environment in support legislative…